1

I am getting lots of error in console when see my site in Firefox.

This site makes use of a SHA-1 Certificate; it's recommended you use certificates with signature algorithms that use hash functions stronger than SHA-1.[Learn More]   sp.runtime.js
This site makes use of a SHA-1 Certificate; it's recommended you use certificates with signature algorithms that use hash functions stronger than SHA-1.[Learn More] WebResource.axd
This site makes use of a SHA-1 Certificate; it's recommended you use certificates with signature algorithms that use hash functions stronger than SHA-1.[Learn More] ScriptResource.axd
This site makes use of a SHA-1 Certificate; it's recommended you use certificates with signature algorithms that use hash functions stronger than SHA-1.[Learn More] style.css
This site makes use of a SHA-1 Certificate; it's recommended you use certificates with signature algorithms that use hash functions stronger than SHA-1.[Learn More] jquery.min.js
This site makes use of a SHA-1 Certificate; it's recommended you use certificates with signature algorithms that use hash functions stronger than SHA-1.[Learn More] bootstrap.min.css
This site makes use of a SHA-1 Certificate; it's recommended you use certificates with signature algorithms that use hash functions stronger than SHA-1.[Learn More] pagelayouts15.css

So looks like its not loading scripts at all. What can i do to get rid of this? Site works fine on chrome and IE. I am using firefox versoin 38.05. Due to this errors when i click on button to upload pictures on list nothing is saved in list. This works ok in chrome and IE

Improve this question
5
  • What protocol are use using, http or https? Does it work on http?
    – Arsalan Shahid
    Commented Jun 26, 2015 at 12:02
  • @ArsalanShahid i am using https
    – DevelopmentIsMyPassion
    Commented Jun 26, 2015 at 12:11
  • This seems to be by design. bugzilla.mozilla.org/show_bug.cgi?id=942515. You need to use a certificate on your server that is using SHA-2
    – Arsalan Shahid
    Commented Jun 26, 2015 at 12:26
  • @ArsalanShahid where exactly to do this? Please can you guide me
    – DevelopmentIsMyPassion
    Commented Jun 26, 2015 at 12:39
  • Is it a development environment? Did you use a self-signed certificate to set up SSL?
    – Arsalan Shahid
    Commented Jun 26, 2015 at 13:05

1 Answer 1

Reset to default
2

@Arsalan is correct. SHA-1 is being phased out. Google is also phasing this out as well, and Microsoft has said it will not support them after Dec 31, 2015.

This basically correlates to 1024 bit encryption (SHA-1) and 2048 bit (SHA-2) encryption (SHA-2). Also note that you need to ensure all your intermediate and root certificates are updated. If you only update the cert and there is an upstream intermediate cert still on SHA-1, you will break validation chain.

This transition actually started quite a bit ago, I would make plans to update your certificates as soon as possible. Your certificate vendor should provide you the new certificates at no charge. If it's internal you need to update your Certificate Authority

** Edit **

NIST Guide if you enjoy reading that type of thing:

http://csrc.nist.gov/publications/nistpubs/800-131A/sp800-131A.pdf

Improve this answer
4
  • As a developer how can i get rid of this. I have no idea how i can remove this.
    – DevelopmentIsMyPassion
    Commented Jun 26, 2015 at 12:55
  • If you are not in charge of managing the server or endpoint there is little you can do. The admins need to request and install new certificates on the servers.
    – Jesus Shelby
    Commented Jun 26, 2015 at 13:09
  • Its my dev env so i have full rights. Is there any guide on how to do it
    – DevelopmentIsMyPassion
    Commented Jun 26, 2015 at 14:04
  • It's not so straight forward - it depends on your certificates. If you are using public certificate authority (digicert, etc), they have instructions for you. If it's internal, you can request it directly from IIS (assuming you have rights to the CA), or you may have to generate the request and upload it to the CA, other wise you need to create a self signed certificate. Depending on your scenario you can use Bing / Google and get step by step guidance on how to request and install the cert. One other options is to just change your bindings to HTTP since it's DEV.
    – Jesus Shelby
    Commented Jun 26, 2015 at 14:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.